Document & Records Management Archives

Advancing CJIS-Ready Cloud Operations with Enterprise Security

Moving to the cloud is a very different proposition when you’re responsible for criminal justice information, whether that includes fingerprints and other biometric data, criminal histories, case records or information about property associated with a crime.

Law enforcement agencies and other organizations subject to CJIS (Criminal Justice Information Services) requirements want the flexibility and operational advantages of the cloud. Yet, they have little room for uncertainty about if or how sensitive information is protected, who can access it or what happens when a critical system goes down.

That sets a high bar for cloud security. And it provides useful context for the launch of Enterprise Security, a new suite of capabilities designed to help organizations securely modernize mission-critical operations in Laserfiche Cloud.

Enterprise Security addresses CJIS and GovRAMP security requirements based on the NIST SP 800-53 framework. It also introduces additional protections against emerging threats while strengthening the controls organizations rely on to keep critical information secure and available.

What Does CJIS Readiness Look Like in Practice?

CJIS readiness isn’t defined by a single security feature. Agencies need to consider how they protect criminal justice information throughout their environment and configure technology around their own requirements.

For IT and security teams, that raises practical questions:

Who can access sensitive information, and how do we manage inactive sessions?
Can we see what users and privileged accounts are doing across the system?
How quickly can we recover if the region hosting our repository becomes unavailable?
Are integrations and automated processes maintaining the protections we put in place?

The last question is particularly easy to overlook. Agencies rarely use an information management platform in isolation. Often, other applications supply information to Laserfiche or retrieve information from it. Automated processes can connect those systems without someone manually moving a document from one place to another. For example, a workflow might route case-related information between systems or make a record available to an authorized user as part of an investigative or administrative process.

Those connections need the same security discipline as the applications themselves. Access should be limited to the information that’s necessary for each user and their role, and protections shouldn’t be lessened or disappear simply because a process has been automated.

Enterprise Security strengthens that environment with enhanced encryption using FIPS 140-3 compliant cryptographic algorithm modules. Configurable inactivity timeouts give organizations greater control over how long sessions remain active, complementing existing capabilities such as role-based access controls and single sign-on.

Together, these technology controls support CJIS security requirements. Agencies remain responsible for understanding the information they manage, configuring their environment appropriately and demonstrating that they meet those requirements in practice.

Seeing Beyond the Repository

Security teams also need to know what’s happening around their information.

Repository audit logs provide a record of activity involving content. Enterprise Security expands that view through an advanced audit trail that covers activity across the system, including user and account security events. Support for integration with SIEM and log aggregation tools allows that activity to become part of the organization’s broader security monitoring.

That wider view is valuable when an agency needs to investigate unusual behavior or review changes to an account. If an administrator’s permissions change unexpectedly or an account begins accessing information it normally doesn’t, security teams need a record of those events alongside activity involving the content itself. It also helps organizations demonstrate that the controls they have in place are working as intended.

For teams managing sensitive information, comprehensive visibility provides a clear record of how people interact with the system, from the access they have to the actions they take.

Preparing for the Outage You Can’t Prevent

Some security events begin with malicious activity. Others begin when infrastructure simply becomes unavailable. Either way, a public safety agency can’t afford to lose access to critical information for an extended period. A regional outage can quickly become an operational problem if criminal histories, identity or case records are unavailable.

Multi-region disaster recovery helps organizations prepare for regional outages, with near real-time account-level replication to support recovery. If a critical issue affects one region, the repository can be brought back online with disaster recovery support. Automated four-hour repository data snapshots provide an additional recovery capability.

This is one of the more consequential ideas behind Enterprise Security. Disaster recovery isn’t separate from protecting mission-critical information. Availability is part of the security commitment.

For agencies evaluating cloud environments through a CJIS lens, that changes the conversation from simply preventing an incident to asking how operations continue when prevention isn’t enough.

Security Threats Aren’t Standing Still

The environment agencies are defending is changing too. AI has introduced questions about how organizations govern the tools they choose to use. It’s also changing the nature of some security threats by making automated activity easier to scale, adapt and target.

Some of these threats are new, while others are longstanding attack methods becoming more sophisticated. Unauthorized AI bots generate large volumes of automated activity, while DDoS attacks increasingly use automation to vary tactics and make malicious traffic harder to distinguish from legitimate use. Both can overwhelm systems and disrupt availability. Laserfiche Cloud includes protections against these types of threats and can adapt over time.

Setting a Higher Bar for Cloud Security

For agencies working toward CJIS readiness, evolving threats add to an already high security bar. They need technology that protects sensitive information as applications connect and processes become automated, without creating so much friction that employees find ways around it. They also need a path back to normal operations when something unexpected happens.

Enterprise Security was built to strengthen that underlying architecture in Laserfiche Cloud, supporting rigorous security requirements while helping agencies prepare for what comes next.

Stronger cloud security creates room to modernize with greater confidence while maintaining the protections required for criminal justice information.

The standard is high because the information demands it.

Learn key considerations of establishing long-term enterprise resiliency by downloading the Operational Guide to CJI now.

Download ebook

Virginia Association of Govt Archivers & Records Admins

The Virginia Association of Government Archives & Records Administrators (VAGARA) is a statewide, not-for-profit organization whose members are affiliated with state or local government and who are concerned with the management of public records.

The annual conference is an opportunity for members and friends to gather for education and networking with those who share an interest in government archives and records management issues. The 2026 Annual Conference will be hosted from Great Wolf Lodge in Williamsburg, October 21-23. Registration for the 2026 Annual Conference is now closed. We look forward to welcoming attendees to Great Wolf Lodge later this month! VAGARA wishes to extend its gratitude to Visit Williamsburg for generously supporting the 2026 Annual Conference.

Sensitive Data, High Stakes: Rethinking Cloud Security with PII and CJI

No industry gets a pass when it comes to protecting sensitive data like personally identifiable information (PII) or criminal justice information (CJI).

Healthcare providers hold deeply personal medical histories. Financial institutions manage information about customers’ identities and assets. Employers are entrusted with confidential records about their people. When that information falls into the wrong hands or suddenly becomes unavailable, the impact reaches far beyond compliance.

Some of the most rigorous security standards pertain to government organizations, including the Criminal Justice Information Services (CJIS) Security Policy and GovRAMP. Although they were created to protect sensitive data within government agencies, many of the security principles behind them have much broader relevance because those standards were built based on global best practices like NIST. Across public and private sector industries, many of the same fundamentals apply to keeping sensitive information secure and available.

The security bar within every industry should reflect what’s at stake.

Document Management and Security: Where Gaps Can Take Hold

Security policies are only as effective as applied. As sensitive information, like PII and CJI, moves through a business, across different file types, and into unstructured data and documents, even routine activity can create gaps:

An employee changes roles but retains access to information they no longer need.

Sensitive records remain in a repository beyond their required retention period.

A security team investigating an incident can’t easily determine who accessed information or changed security settings.

Those gaps become harder to spot when information is scattered across systems or governed differently from one department to another.

Bringing sensitive information into a centralized document management system makes it easier to apply security and governance policies consistently. Access controls can limit who sees the data, while automated retention and disposition help prevent records from being kept longer than necessary. Auditing creates a record of activity that security teams can turn to when something goes wrong.

For organizations managing sensitive information under stringent security and regulatory requirements, Laserfiche Enterprise Security features extend these protections with additional security controls in Laserfiche Cloud.

Getting a Handle on Your Information

You can’t consistently protect sensitive information if you don’t know where it is or what it contains.

Customer, patient, constituent and employee information can be spread across forms, contracts, scanned documents and other business records. Consistent classification and metadata make that information easier to identify, so the right controls can be applied based on its contents and how it needs to be handled.

AI raises the stakes. AI tools and agents need clearly defined, role-appropriate access to this kind of information, just as employees do. Well-structured data provides the context AI needs to take action appropriately, while access controls determine what those tools can reach.

Knowing what information exists also helps teams determine when it no longer needs to be kept. Safely disposing of records at the appropriate time reduces the amount of sensitive data that needs to be protected long term.

A Clear Line of Sight

For the information that remains, it’s crucial to have a clear picture of who accesses it and how they use it. This visibility is especially important for privileged accounts, where elevated access can allow users to make changes across repositories, workflows and security settings.

With advanced audit tracking in Enterprise Security, organizations can capture user login activity, system changes and security events. This helps security teams trace suspicious activity and understand what happened when something goes wrong.

It can also take some of the work out of audits. Instead of piecing together evidence after the fact, organizations have a clearer record of how security controls are being applied.

Planning for the Unexpected

Protecting information also requires planning for what happens when systems go down. Critical information needs to stay accessible when the business depends on it. An outage can interrupt patient and customer services, or bring production and supply chain processes to a halt. The longer information remains unavailable, the greater the disruption.

Multi-region disaster recovery in Enterprise Security uses near real-time, account-level repository data replication and multi-region failover to help maintain access to critical information during a large-scale infrastructure failure. It also helps quickly restore operations following these incidents.

That resilience helps people keep working through disruptions and reduces the risk of an outage bringing mission-critical operations to a standstill.

Cloud Security to Support AI Governance

The right policies, regulations and protections will look different from one industry to the next. Organizations need to understand the security and compliance requirements that apply to them and configure their technology and policies accordingly.

Enterprise Security helps put those policies into practice, extending Laserfiche Cloud with advanced security, auditing and disaster recovery capabilities designed for organizations with stringent information security requirements. Together, these added protections strengthen how sensitive information is secured as it moves through the business.

Ultimately, the sensitivity of the information should determine the security bar. When the stakes are high, the protections should be too.

Discover how to deploy CJIS-ready information governance and responsible AI to secure sensitive data now.

Download ebook

Laserfiche Names Garrett Boss as CIO to Lead Enterprise IT, Security, and Business Transformation

LONG BEACH, CALIFORNIA, Sept. 29, 2026 — Laserfiche — the leading SaaS provider of intelligent content management and business process automation — today announced the appointment of Garrett Boss as chief information officer. Boss will oversee Laserfiche’s global IT services team and business transformation office, including deployment of internal Laserfiche solutions and all other enterprise-wide IT systems. In this role, he will also oversee governance, risk, and compliance, supporting Laserfiche’s mission to scale AI innovation while safeguarding the critical content and lifecycle tools customers rely on.

“Laserfiche’s own technology infrastructure and security posture are central to how we deliver an exceptional product and responsive services,” said CEO Karl Chan. “Garrett is a proven leader with a track record of leading global IT and governance teams as they scale and accelerate innovation. I am confident his leadership will help move Laserfiche forward as we shape the future of our platform.”

Boss has over 20 years of experience aligning digital transformation initiatives with business outcomes. Most recently, as executive vice president, Enterprise & Data Platforms at FOX Corporation, he led efforts to integrate agentic workflows across FOX’s application portfolio, to accelerate product updates and feature releases, and reduce time-to-market for software improvements. He is passionate about making a positive impact enterprise-wide, building delivery-focused teams that operate with clarity, and providing technology solutions that create measurable value. At Laserfiche, Boss will support Laserfiche’s continuous innovation and delivery of seamless experiences to partners and customers.

“I’m honored to join Laserfiche at such a pivotal moment in the company’s journey,” said Boss. “Laserfiche has long been a leader in helping organizations manage information and automate critical business processes, and I’m especially excited about the company’s strategy for AI and context management. The value of enterprise AI depends heavily on the quality and context of the information that grounds it. Laserfiche is uniquely positioned to help organizations transform their unstructured content into trusted, actionable context that can be securely integrated into AI-powered workflows. I look forward to working alongside Karl and the entire leadership team to advance our technology strategy, accelerate innovation and deliver intuitive, seamless experiences that empower our customers and partners to thrive.”

Laserfiche provides enterprise-scale, AI-driven content management solutions to more than 10 million users globally. The company is headquartered in Long Beach, California.

About Laserfiche

Laserfiche is the leading enterprise platform that helps organizations digitally transform operations and manage their content with AI-powered solutions. Through scalable workflows, customizable forms, no-code templates and AI-enabled capabilities, the Laserfiche® document management platform accelerates how business gets done. Trusted by organizations of all sizes — from startups to Fortune 500 enterprises — Laserfiche empowers teams to boost productivity, foster collaboration, and deliver a superior customer experience at scale. Headquartered in Long Beach, California, Laserfiche operates globally, with offices and partners across the Americas, Europe, the Middle East and Asia.

Texas A&M University Scales Process Automation Across Campus

Knowledge Worth Preserving

With more than 81,000 students and tens of thousands of faculty, staff and student workers, Texas A&M University operates at a scale that few institutions can match. That size creates opportunities for innovation, but it also introduces complexity. Across the university, teams are constantly finding better ways to work while supporting the student experience and world-class research. What succeeds in one department, however, doesn’t always make its way to another.

That challenge became even more apparent as university operations evolved under new leadership. Consolidation efforts brought resources together across colleges and business units, creating new opportunities to streamline services. It also highlighted differences in how work was performed.

“At Texas A&M, one department may solve a problem that another doesn’t even realize has already been solved somewhere else,” said Michael Berardi, IT director for the Bush School. “We needed ways to make successful processes repeatable across the university.”

Additionally, as experienced employees retired, years of institutional knowledge often left with them. Capturing and standardizing processes became increasingly important for ensuring continuity and supporting future growth.

One Platform, Many Possibilities

Texas A&M selected Laserfiche as its enterprise document management platform more than two decades ago. What began as a document management initiative evolved into a platform for process automation, reporting, records management and system integration.

Across the university, teams adapted the platform to support their own operational priorities:

Research operations gains visibility into workloads. Research Enterprise Business Services replaced paper-based processes with digital forms and reporting. Teams can now track submission volumes, monitor workloads and allocate resources based on real-time data. Required fields reduce back-and-forth communication via email and help ensure submissions are complete the first time. “When I first started, everything was paper,” said Kayla Kitchens, administrator II. “With Laserfiche we can now see how much work each person is handling and make adjustments when new responsibilities come in. Before, we had no way to measure that.”
Human Resources streamlines onboarding. HR uses Laserfiche for onboarding, personnel file management, awards nominations and disclosure processes. Integrations with faculty affairs, employee ID and service management systems allow information to move automatically between applications. This reduces manual effort and accelerates employee onboarding so new faculty and staff can begin supporting students sooner. “We built several Laserfiche integrations into our onboarding process,” said Paige Green, service quality consultant. “When a faculty hire is approved, that information can automatically flow into the onboarding workflow so the next steps can begin immediately.”
Texas A&M University at Qatar automates HR and finance workflows. As part of Texas A&M’s global education network, Texas A&M University at Qatar uses Laserfiche Forms, workflows and the repository to eliminate manual record keeping and help staff manage records, enforce retention requirements and automate approvals. As users become familiar with the platform, they continue identifying new opportunities to simplify processes and reduce human error. “Once they see how easy it is to use Laserfiche, they start asking why we didn’t start using it sooner,”said Faith Stringer, assistant director of business operations.
Recruiting teams reclaim valuable time. At the Bush School, recruiters were spending significant time coordinating interview schedules for prospective students each year. After implementing a Laserfiche workflow, the team reduced administrative effort by over 100 hours across two employees, giving staff more time to focus on prospective students rather than scheduling logistics. “Laserfiche gave them their weekends and nights back,” said Berardi. “That’s a significant improvement for the people doing the work.”

Solutions Shaped By the People Using Them

As usage expanded, departments began quantifying the impact of automation across the university. For example, the employee ID card process was previously kicked off via email, requiring human intervention to route, upload and manually type information into an Excel sheet to complete. “This was strenuous and there was a lot of room for human error,” said Priya Karthick, enterprise IT technologist.

Using Laserfiche to automating the process reduced processing time by approximately 540 hours over a six-month timeframe.

These gains build on the scale of Texas A&M’s broader Laserfiche program. Today, the university supports nearly 70 repositories, more than 100 forms-based processes and approximately 30,000 users across the Texas A&M system.

“What started with just a few repositories has grown into a platform used across the university system,” Karthick explained. “As more departments adopted Laserfiche, they found new opportunities to automate processes and improve efficiency.”

The growth of Laserfiche at Texas A&M has been shaped by a culture of sharing and continuous improvement. Because Laserfiche’s low-code tools are accessible to technical and non-technical users alike, they can build on each other’s ideas rather than starting from scratch. A workflow developed for one team often becomes the starting point for another. Each automated task, documented workflow and shared process frees employees to focus on the university’s core mission of serving students and advancing research.

“Laserfiche gives people the gift of time,” said Berardi. “And that’s value that reaches every level of the organization.”

Introduction to the Repository

New to working with documents in Laserfiche? In this hands-on lab, follow along with our expert instructors to learn how to use the Laserfiche repository.

Funding CJIS Modernization: Where Government Agencies Can Find Grant Support

Police officer in yellow vest on blue background with CJIS emblem

Criminal justice agencies have plenty of reasons to modernize aging information systems. But what often stands in their way is cost.

Federal funding is available, but there’s no single grant dedicated specifically to CJIS (Criminal Justice Information Services) modernization. Instead, the dollars are spread across criminal justice, technology and cybersecurity programs with different priorities and eligibility requirements.

That makes the way agencies define their modernization projects especially important. CJIS modernization can take many forms, from replacing aging document repositories and automating case workflows to strengthening records governance, security and continuity of operations. These investments can give investigators faster access to records, improve CJIS audit readiness and help authorized justice partners share information more securely.

Connecting technology investments to outcomes like these can help agencies identify funding programs that align with what they want to achieve.

Broad CJIS Modernization: Byrne JAG

The Edward Byrne Memorial Justice Assistance Grant (Byrne JAG) Program is one of the broadest funding opportunities for CJIS modernization. Its expansive scope makes it a potential funding source for CJIS modernization products involving secure records management, digital case files, automated workflows and information sharing.

Eligible cities and counties receive JAG awards directly from the U.S. Department of Justice, while funding also reaches state and local governments through state-administered programs. This gives agencies multiple avenues to explore for CJIS modernization projects.

Improving Criminal Justice Records with NCHIP and NARIP

Projects focused on criminal history information have more targeted options.

The National Criminal History Improvement Program (NCHIP) supports improvements to criminal history records and disposition reporting, as well as information sharing and integration among courts, prosecutors and law enforcement.

Similar in scope is the NICS Act Record Improvement Program (NARIP), which focuses on records supporting the National Instant Criminal Background Check System. Eligible projects can include protection order automation, court disposition reporting, improvements to record completeness and workflow automation.

Both programs are generally administered at the state level, so municipal agencies typically participate through statewide initiatives.

Supporting Pilots and Technology Projects with COPS Funding

For those looking to test a new approach, the Community Policing Development Microgrants Program can support demonstration and pilot projects. Current FY2026 awards provide up to $200,000 for potential initiatives supporting digital investigative case management, secure collaboration with prosecutors, cybercrime documentation or CJIS-secure information sharing.

The COPS Technology and Equipment Program provides another option for law enforcement technology projects. Eligible investments range from secure cloud modernization to regional information sharing and disaster recovery. Funding comes through Congressionally Directed Spending, so agencies must work with their Congressional delegation during the appropriations process.

Connecting CJIS Modernization to Cybersecurity

Some CJIS modernization projects may fall under the umbrella of broader cybersecurity funding.

The State and Local Cybersecurity Grant Program supports initiatives such as secure cloud migration, identity management and disaster recovery. Funding can also extend to secure storage and audit capabilities when the work aligns with a state’s approved cybersecurity plan. For criminal justice agencies, these priorities translate into stronger access controls and clear audit histories, as well as maintaining reliable access to critical information during disruptions.

The Homeland Security Grant Program offers another potential funding source, particularly for projects that strengthen regional intelligence sharing or improve the security and availability of critical information. Continuity-of-operations investments may also qualify.

More Specialized Funding Opportunities

Depending on the project, organizations can also explore programs aimed at specific areas of the criminal justice system.

Paul Coverdell Forensic Science Improvement Grants: Forensic operations, including digital records, evidence documentation and audit history.
Office on Violence Against Women funding: Protection orders, victim services and confidential information management.
Coordinated Tribal Assistance Solicitation and Tribal Access Program: Tribal justice organizations and initiatives involving secure records and criminal justice information.
State Justice Institute grants: Court modernization planning, process redesign and information governance planning.

Connecting Funding to CJIS Modernization

Funding opportunities and eligibility evolve from one cycle to the next. Agencies can navigate these changing opportunities more effectively by first defining what they want to improve.

Laserfiche supports these efforts by helping organizations securely manage criminal justice records, automate workflows, govern access and maintain audit histories. Together, these capabilities provide an information foundation for technology investments tied to public safety and operational goals.

Modernization is the project, but the outcome is what ultimately makes the case for funding.

New Laserfiche AI Innovations! – December

New Laserfiche AI Innovations! – November

Data is the Key to Protecting Environmental and Cultural Resources

The Nez Perce Tribe’s Environmental Restoration and Waste Management (ERWM) division plays a vital role in safeguarding irreplaceable cultural resources and critical data related to the cleanup of the Hanford site, a former nuclear production complex.

This program’s crucial work demands robust information management to support data integrity and security, as well as promote accessibility for future generations.

To address these needs, the ERWM turned to Laserfiche. The platform’s advanced search capabilities, comprehensive recordkeeping features, and robust security controls have empowered the tribe to effectively manage critical information while maintaining data sovereignty. Through a partnership with Laserfiche solution provider Intertribal Software, the tribe uses Laserfiche to preserve its heritage and provide leadership in environmental stewardship.

“Laserfiche is important to our function as a program, but also for storing information that relates to our culture — preserving it and making it accessible to future generations is key,” said Antonio Smith, communications specialist at the Nez Perce Tribe.

A Data-Driven Approach to Environmental Stewardship

Established in 1943 as part of the Manhattan Project, the Hanford site occupies 586 square miles along the Columbia River in the state of Washington. While the federal government used the site to produce nuclear materials for national defense, the archaeological record of Native American habitation of the area goes back over 10,000 years.

“We have stories about the land,” Smith said. “We have names for the land that are different than the names people use today. We have purposes for that land that are different than current purposes. This information is for us and our generations to follow.”

When the U.S. government announced a Hanford cleanup effort, the tribes and additional non-governmental organizations got involved. Their role was to guarantee the cleanup respected tribal standards and, importantly, progressed toward a full ecological restoration of the land, beyond simply making it suitable for certain commercial activities.

The amount of information the ERWM has about the land is significant, and ranges from land agreements and culturally significant documentation, to the tribe’s own testing data that is vital to the division’s work with U.S. government agencies. The critical nature of the information, however, was not reflected in how it was stored.

“We had a single-wide trailer full of files from floor to ceiling,” Smith described. “We couldn’t search them, and when we needed to refer to something, the issue was locating the box it was in or even the room it was in. A lot of the documents we have are large. As a Department of Energy-funded program, we receive reports that are quite extensive and involve multiple contractors, so this method of storage was not sustainable.”

The importance of this information necessitated a storage solution that was:

Searchable: The ERWM needed a central repository that enabled efficient and rapid retrieval of specific documents, data points and historical records.
Accessible: It was critical to provide authorized personnel with timely and reliable access to the information they need to do their job.
Secure: The division prioritized a solution that had robust security tools to protect sensitive cultural resources, sovereign data, and environmental findings from unauthorized access, modification or loss.

“Laserfiche is the solution we needed,” Smith said. “When we looked at all the different options we had, it came out on top. We have information referencing land that goes back thousands of years. To be able to now capture all of that digitally and make it accessible for future generations is vital. Otherwise, it could be in buildings getting moldy or burnt or stolen.”

Maintaining Data Sovereignty for Future Generations

Today, the ERWM continues its essential work to restore and protect environmental and cultural resources, now with Laserfiche to support staff in retrieving the information they need, when they need it. The tribe can also rest assured that it has the tools to safeguard precious and confidential information that must be preserved for generations to come.

“Our culture is key to everything,” Smith said. “It’s not just our past; it’s our present; it’s how we function. This information is the future for our children, and we can’t lose that.” The ERWM is also exploring new opportunities to streamline processes in other areas such as human resources forms and travel forms. The effort will help the ERWM to be more efficient, and reclaim time for doing what matters most: protecting the environment.